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Abstract. Alice and Bob wish to communicate without the archvil- 
lainess Eve eavesdropping on their conversation. Alice, decides to take 
two college courses, one in cryptography, the other in quantum mechan- 
ics. During the courses, she discovers she can use what she has just 
learned to devise a cryptographic communication system that automat- 
ically detects whether or not Eve is up to her villainous eavesdropping. 
Some of the topics discussed are Heisenberg's Uncertainty Principle, the 
Vernam cipher, the BB84 and B92 cryptographic protocols. The talk 
ends with a discussion of some of Eve's possible eavesdropping strate- 
gies, opaque eavesdropping, translucent eavesdropping, and translucent 
eavesdropping with entanglement. 
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1. Preface 



1.1. The Unique Contribution of Quantum Cryptography. Before 
beginning our story, I'd like to state precisely what is the unique contribution 
of quantum cryptography. 

Quantum cryptography provides a new mechanism enabling the parties 
communicating with one another to: 

Automatically Detect Eavesdropping 



Consequently, it provides a means for determining when an encrypted 
communication has been compromised. 
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1.2. A Note to the Reader. This paper is based on an invited talk given 
at the Conference on Coding theory, Cryptology, and Number Theory held 
at the US Naval Academy in Annapolis, Maryland in October of 1998. It 
was also given as an invited talk at the Quantum Computational Science 
Workshop held in conjunction with the Frontiers in Computing Conference 
in Annapolis, Maryland in February of 1999, at a Bell Labs Colloquium in 
Murray Hill, New Jersey in April of 1999, at the Security and Technology 
Division Colloquium of NIST in Gaithersburg, Maryland, and at the Quan- 
tum Computation Seminar at the U.S. Naval Research Labs in Washington, 
DC. 

My objective in creating this paper was to write it exactly as I had given 
the talk. But ... Shortly after starting this manuscript, I succumbed to the 
temptation of greatly embellishing the story that had been woven into the 
original talk. I leave it to the reader to decide whether or not this detracts 
from or enhances the paper. 

2. Introduction 

We begin our crypto drama with the introduction of two of the main 
characters, Alice C^and'v' Bob, representing respectively the sender and 
the receiver. As in every drama, there is a triangle. The triangle is com- 
pleted with the introduction of the third main character, the archvillainess 
Eve, representing the eavesdropper. 

Our story begins with Alice and Bob attending two different universities 
which are unfortunately separated by a great distance. Alice would like 
to communicate with Bob without the ever vigilant Eve eavesdropping on 
their conversation. In other words, how can Alice talk with Bob while at the 
same time preventing the evil Eve from listening in on their conversation? 

3. A Course on Classical Cryptography 

3.1. Alice's enthusiastic decision. Hoping to find some way out of her 
dilemma, Alice elects to take a course on cryptography. Crypto 351 taught by 
Professor Shannon with guest lecturers Diffie, Rivest, Shamir, and Adleman. 
Alice thinks to herself, "Certainly this is a wise choice. It is a very applied 
course, and surely relevant to the real world. Maybe I will learn enough to 
outwit Eve?" 



3.2. Plaintext, ciphertext, key, and ... Catch 22. Professor Shannon 
begins the course with a description of classical cryptographic communi- 
cation systems, as illustrated in Fig. 1. Alice, the sender, encrypts her 
plaintext P into ciphertext C using a secret key K which she shares 
only with Bob, and sends the ciphertext C over an insecure channel on 
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which the evil Eve is ever vigilantly eavesdropping. Bob, the receiver, re- 
ceives the ciphertext C, and uses the secret key K, shared by him and Alice 
only, to decrypt the ciphertext C into plaintext P. 
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Figure 1. A classical cryptographic communication system. 

What is usually not mentioned in the description of a classical crypto- 
graphic communication system is that Alice and Bob must first communi- 
cate over a secure channel to establish a secret key K shared only by Alice 
and Bob before they can communicate in secret over the insecure channel. 
Such a channel could consist, for example, of a trusted courier, wearing a 
trench coat and dark sunglasses, transporting from Alice to Bob a locked 
briefcase chained to his wrist. In other words, we have the famous Catch 
22 of classical cryptography, namely: 

Catch 22. There are perfectly good ways to communicate in secret, 
provided we can communicate in secret ... 

Professor Shannon then goes on to discuss the different types of classical 
communication security. 



3.3. Practical Secrecy. A cryptographic communication system is prac- 
tically secure if the encryption scheme can be broken after X years, where 
X is determined by one's security needs and by existing technology. Prac- 
tically secure cryptographic systems have existed since antiquity. One ex- 
ample would be the Caesar cipher used by Julius Caesar during the during 
the Gallic wars, a cipher that was difficult for his opponents to break at that 
time, but easily breakable by today's standards. A modern day example of 
a practically secure classical cryptographic system is the digital encryption 
standard (DES) which has just recently been broken]^. For this and many 
other reasons, DES is to be replaced by a more practically secure classi- 
cal encryption system, the Advanced Encryption Standard (AES). In turn, 

^Tim O'Reilly and the Electronic Frontier Foundation have constructed a computing 
device for $250,000 which does an exhaustive key search on DES in 4.5 days[^. See also 
pi and As far as I know, triple DES has not been broken. 
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AES will be replaced by an even more secure cryptographic system should 
the advances in technology ever challenge its security. 

3.4. Perfect Secrecy. A cryptographic communication is said to be per- 
fectly secure if the ciphertext C gives no information whatsoever about 
the plaintext P, even when the design of the cryptographic system is known. 
In mathematical terms, this can be stated succinctly with the equation: 

PROB{P I C) = PROB{P). 

In other words, the probability of plaintext P given ciphertext C, written 
PROB(P\C), is equal to the probability of the plaintext P. 

An example of a perfectly secure classical cryptographic system is the 
Vernam Cipher, better known as the One-Time-Pad. The plaintext P 
is a binary sequence of zeroes and ones, i.e., 

P = Pi,P2,P3, ••• Pn, ••• 

The secret key K consists of a totally random binary sequence of the same 
length, i.e., 

K = Ki,K2,Ks, ... , Kn, ... 
The ciphertext C is the binary sequence 

C = Ci,C2,Cs, ... Cn, ... 
obtained by adding the sequences P and K bitwise modulo 2, i.e., 
Ci = Pi + Kimod2 for i = 1,2,3,... 

For example, 

P = 0110 0101 1101 
K = 1010 1110 0100 



C = P®K = 1100 1011 1001 

This cipher is perfectly secure if key K is totally random and shared only 
by Alice and Bob. It is easy to encode with the key K. If, however, 
one succumbs to the temptation of using the same key K to encode two 
different plaintexts P*^^^ and P*^^^ into ciphertexts C^-^^ and C^'^\ then the 
cipher system immediately changes from a perfectly secure cipher to one that 
is easily broken by even the most amateur cryptanalyst. For, C^^^ © C^^^ = 
P(^) © p(^) is easily breakable because of the redundancy that is usually 
present in plaintext. 

The only problem with the onc-timc-pad is that long bit sequences must 
be sent over a secure channel before it can be used. This once again leads 
us to the Catch 22 of classical cryptography, i.e.. 
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Catch 22. There are perfectly good ways to communicate in secret, 
provided we can communicate in secret ... 

... and to the: 

• Key Problem 1. Catch 22: A secure means of communicating key 
is needed .0 

Finally, there are two other key problems in classical cryptography in need 
of a solution, namely: 

• Key Problem 2. Authentication: Alice needs to determine with 
certainty that she is actually talking to Bob, and not to an impostor 
such as Eve. 

• Key Problem 3. Intrusion Detection: Alice needs a means of deter- 
mining whether or not Eve is eavesdropping. 

In summary, we have the following checklist for classical cryptographic 
systems: 



Check List for Classical Crypto Systems 




■ Catch 22 Solved? 


NO 


■ Authentication? 


NO 


■ Intrusion Detection? 


NO 



3.5. Computational Security. Relatively recently in the history of cryp- 
tography, Diffie and Hellman Q, HI suggested a new type cryptographic 
secrecy. A cipher is said to be computationally secure if the computa- 
tional resources required to break it exceed anything possible now and into 
the future. For example, a cipher would be computationally secure if the 
number of bits of computer memory required to break it were greater than 
the number of atoms in the universe, or if the computational time required 
to break it exceeded the age of the universe. Cryptographic systems can 
be created in such a way that it is computationally infeasible to find the 
decryption key D even when the encryption key E is known. To create 
such a cryptographic system, all one would need is a trap-door function /. 

Definition 1. A function f is a trap- door function if 

1) f is easy to compute, i.e., polynomial time computable, and 

^Hired trench coats are exorbitantly expensive and time consuming. 
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2) Given the function f, the inverse function f~^can not be computed 
from f in polynomial time, i.e., such a computation is superpolynomial 
time, intractable, or worse. 
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Figure 2. A public key cryptographic communication system 



A trap-door function E can be used to create a public key crypto- 
graphic system as illustrated in Fig.2. All parties who wish to commu- 
nicate in secret should choose their own trap-door function E and place it 
in a public directory, the "yellow pages," for all the world to see. But 
they should keep their decryption key D = E~^ secret. Since is a trap- 
door function, it is computationally infeasible for anyone to use the publicly 
known E to find the decryption key D. So D is secure in spite of the fact 
that its inverse E is publicly known. 

If Alice wishes to send a secret communication to Bob, she first looks up 
in the yellow pages Bob's encryption key Eb, encrypts her plaintext P with 
Bob's encryption key Eb to produce ciphertext C = Eb{P), and then sends 
the ciphertext C over a public channel. Bob receives the ciphertext C, and 
decrypts it back into plaintext P = Db{C) using his secret decryption key 
Db. 

Alice can even do more than this. She can authenticate, i.e., sign 
her encrypted communication to Bob so that Bob knows with certitude 
that the message he received actually came from Alice and not from an 
Eve masquerading as Alice. Alice can do this by encrypting her signa- 
ture ACIC8 using her secret decryption key Da into DAiACICS). She 
then encrypts plaintext P plus her signature DA{AdCS) using Bob's pub- 
licly known encryption key Eb to produce the signed ciphertext Cg = 
Eb{P + Da{ACIC£)), and then sends her signed ciphertext Cs over the 
public channel to Bob. Bob can then decrypt the message as he did before to 
produce the signed plaintext P+Da{ACIC£). Bob can verify Alice's digital 
signature Da{ACTC£) by looking up Alice's encryption key Ea in the "yel- 
low pages," and using it to find her signature Ea{Da{ACXC£)) = ACZCE. 
In this way, he authenticates that Alice actually sent the message because 
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only she knows her secret decryption key. Hence, only she could have signed 
the plaintext .0 

The RSA cryptographic system is believed to be one example of a public 
key cryptographic system. There are many public software implementations 
of RSA, e.g., PGS (Pretty Good Security). 

Thus, besides solving the authentication problem for cryptography, public 
key cryptographic systems appear also to solve the Catch 22 of cryptography. 
However, frequently the encryption and decryption keys of a public key 
cryptographic system are managed by a central key bank. In this case, the 
Catch 22 problem is still there. For that reason, we have entered 'MAYBE' 
in the summary given below. 



Check List for PKS 




■ Catch 22 Solved? 


MAYBE 


■ Authentication? 


YES 


■ Intrusion Detection? 


NO 



4. A Course on Quantum Mechanics 

4.1. Alice's Reluctant Decision. In spite of Alice's many intense efforts 
to avoid taking a course in quantum mechanics, she was finally forced by 
her university's General Education Requirements (GERs) to register for the 
course Quantum 317, taught by Professor Dirac with guest lecturers Feyn- 
man, Bennett, and Brassard. She did so reluctantly. "After all," she 
thought, "Certainly this is an insane requirement. Quantum mechanics is 
not applied. It's too theoretical to be relevant to the real world. Ugh! But 
I do want to graduate." 



4.2. The Classical World — Introducing the Shannon Bit. Professor 
Dirac began the course with a brief introduction to the classical world of 
information. In particular, Alice was introduced to the classical Shannon 
Bit, and shown that he/she/it is a very decisive individual. The Shannon 
Bit is either or 1, but by no means both at the same time. 

"Hmm ... ," she thought, "I bet that almost everyone I know is gainfully 
employed because of the Shannon Bit." 

■^Because of the need for brevity, we have not discussed aU the subtleties involved with 
digital signatures. For example, for more security, Alice should add a time stamp and 
some random symbols to her signature. For more information on digital signatures, please 
refer to one of the standard references such as IM. 
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The professor ended his brief discussion of the Shannon Bit by mentioning 
that there is one of its properties that we take for granted. I.e., it can be 
copied. 



4.3. The Quantum World — Introducing the Qubit. Next Professor 
Dirac switched to the mysterious world of the quantum. He began by 
introducing the runt of the Bit clan, i.e., the Quantum Bit, nicknamed 
Qubit. He began by showing the class a small dot, i.e., a quantum dot. 
In fact it was so small that Alice couldn't see it at all. He promptly pulled 
out a microscope^, and projected a large image on a screen for the entire 
class to view. 

Professor Dirac went on to say, "In contrast to the decisive classical Shan- 
non Bit, the Qubit is a very indecisive individual. It is both and 1 at the 
same time! Moreover, unlike the Shannon Bit, the Qubit cannot be copied 
because of the no cloning theorem of Dieks, Wootters, and Zurek^|25]. 
Qubits are very slippery characters, exceedingly difficult to deal with." 

"One example of a qubit is a spin ^ particle which can be in a spin-up 
state |1) which we label as 1, in a spin-down state |0) which we label as 0, or 
in a superposition of these states, which we interpret as being both and 
1 at the same time." (The term "superposition" will be explained shortly.) 

"Another example of a qubit is the polarization state of a photon. A 
photon can be in a vertically polarized state ||). We assign a label of 1 to 
this state. It can be in a horizontally polarized state We assign a 

label of to this state. Or, it can be in a superposition of these states. In 
this case, we interpret its state as representing both and 1 at the same 
time." 

"Anyone who has worn polarized sunglasses should be familiar with the 
polarization states of the photon. Polarized sunglasses eliminate glare be- 
cause they let through only vertically polarized light while filtering out the 
horizontally polarized light that is reflected from the road." 



4.4. Where do qubits live? But where do qubits live? They live in a 
Hilbert space 7i. By a Hilbert space, we mean: 

Definition 2. A Hilbert Space is a vector space over the complex numbers 
C together with an inner product 

{ , ) -.nxH — >c 

such that 

1) (ui +U2,v) = {ui,v) + {u2,v) for all ui,U2,v G H 
''This is a most unusual microscope! 
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2) (n, Xv) = (An, v) for all u,v GTi and A € C 

3) {u,v)* = {v,u) for all u,v TC , where the superscript '*' denotes 
complex conjugation. 

4) For every Cauchy sequence ui,U2, Us, ... inH, 

lim Un exists and lies in TL 

n— >oo 

In other words, a Hilbert space is a vector space over the complex numbers 
C with a sequihnear inner product in which sequences that should converge 
actually do converge to points in the space. 



4.5. Some Dirac notation — Introducing kets. The elements of Ti are 
called kets, and will be denoted by 

\lahel) , 

where '|' and '>' are left and right delimiters, and HabeV denotes any label, 
i.e., name, we wish to assign to a ket. 



4.6. Finally, a definition of a qubit. So finally, we can define what is 
meant by a qubit. 

Definition 3. A qubit is a ket (state) in a two dimensional Hilbert space 

n. 

Thus, if we let |0) and |1) denote an arbitrary orthonormal basis of a two 
dimensional Hilbert space 7i, then each qubit in 7i can be written in the 
form 

\quhit) = ao |0) + ai jO) 

where cki € C. Since any scalar multiple of a ket represents the same 
state of an isolated quantum system, we can assume, without loss of gener- 
ality, that \quhit) is a ket of unit length, i.e., that 

I |2 , I |2 1 

The above qubit is said to be in a superposition of the states [0) and 
|1). This is what we mean when we say that a qubit can be simultaneously 
both and 1. However, if the qubit is observed it immediately "makes a 
decision." It "decides" to be with probability |ao| and 1 with probability 
|ai|^. Some physicists call this the "collapse" of the wave function^ 



^It is very difficult, if not impossible, to find two physicists who agree on the subject 
of quantum measurement. The phrase "collapse of the wave function" immediately en- 
genders a "war cry" in most physicists. For that reason, "collapse" is enclosed in quotes. 



QUANTUM CRYTOGRAPHY 11 

4.7. More Dirac notation — Introducing bras and bra-c-kets. Given 
a Hilbert space 7i, let 

n* = Hom{n,C) 

denote the set of all linear maps from Tl to C. Then Ti* is actually a Hilbert 
space, called the dual Hilbert space of Ti, with scalar product and vector 
sum defined by: 

(A • /) (l^-)) = A (/(l^))) , for ah A G C and for ah f e H* 

(/i + /2)(|^)) = /i(|^))+/2(|*)), forall/i,/2GW* 
We call the elements of Ti* bra's, and denote them as: 

{label\ 

We can now define a bilinear map 

n* xH — >C 
by 

since bra is a complex valued function of kets. We denote this product 
more simply as 

(^1 I ^2) 

and call it the Bra-c-Ket (or bracket) of bra and ket |^2)- 

Finally, the bracket induces a dual correspondence^ between H. and Ti.*, 
i.e., 

I T \ D.C. I T I 
1^2) < > {^\\ 



4.8. Activities in the quantum world — Unitary transformations. 

All "activities" in the quantum world are linear transformations 

u -.n — 

from the Hilbert space H. into itself, called unitary transformations (or, 
unitary operators). If we think of linear transformations as matrices, then 
a unitary transformation {/ is a square matrix of complex numbers such 
that 

— T — T 

\j u = I = UU 

— T 

where U denotes the matrix obtained from U by conjugating all its entries 
and then transposing the matrix. We denote U hj U\ and refer to it as 
the adjoint of U. 

''This is true for finite dimensional Hilbert spaces, ft is more subtle for infinite dimen- 
sional H[ilbert spaces. 
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Thus, an "activity" in the quantum world would be, for example, a unitary 
transformation U that carries a state ket |^o) at time t = to a state ket 
l^*!) at time t = 1, i.e., 

U : |*o) ^ 

4.9. Observables in quantum mechanics — Hermitian operators. In 

quantum mechanics, what does an observer observe? 

All observables in the quantum world are linear transformations 

o-.n — 

from the Hilbcrt space H into itself, called Hermitian operators (or, self- 
adjoint operators). If wc think of linear transformations as matrices, then 
a Hermitian operator O is a square matrix of complex numbers such that 

— T 

o =o 

— T 

where O again denotes the matrix obtained from O by conjugating all its 
entries, and then transposing the matrix. As before, we denote O by 0\ 
and refer to it as the adjoint of O. 

Let \ipi) denote the eigenvectors, called eigenkets, of an observable O, 
and let ai denote the corresponding eigenvalue, i.e., 

O : \(pi) = ai \ipi) 

In the cases we consider in this talk, the eigenkets form an orthonormal basis 
of the underlying Hilbert space H. 

Finally, we can answer our original question, i.e.. 

What does an observer observe? 



Let us suppose that we have a physical device M that is so constructed 
that it measures an observable O, and that we wish to use M to measure 
a quantum system which just happens to be in a quantum state l^*). We 
assume l^*) is a ket of unit length. The quantum state l^*) can be written 
as a linear combination of the eigenkets of O, i.e., 

I*> = I'Pi) 

When we use the device M to measure l^*), we observe the eigenvalue 

I 1 2 • 

with probability pi = \ai\ , and in addition, after the measurement the 
quantum system has "collapsed" into the state \<fi). Thus, the outcome of 
a measurement is usually random, and usually has a lasting impact on the 
state of the quantum system. 

We can use Dirac notation to write down an expression for the average 
observed value. Namely, the averaged observed value is given by the 
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expression (^'[ (O which is written more succinctly as or 
simply as [O) . 



4.10. The Heisenberg uncertainty principle — A limitation on what 
we can actually observe. There is, surprisingly enough, a limitation of 
what can be observed in quantum mechanics. 

Two observables A and B are said to be compatible if they commute, 
i.e., if 

AB = BA. 

Otherwise, they are said to be incompatible. 

Let [A, -B], called the commutator of A and B, denote the expression 

[A, B]=AB- BA 

In this notation, two operators A and B are compatible if and only if [A, B] = 
0. Finally, let 

AA = A- (A) 

The following principle is one expression of how quantum mechanics places 
limits on what can be observed: 

Heisenberg's Uncertainty Principle]] 

{{AA)'){{ABf)>\\\{[AB])f 

where <^(AA)^^ = (^-j {AAf |^) is the mean squared standard devia- 
tion of the observed eigenvalue, written in Dirac notation. It is a measure 
of the uncertainty in A. 

This if A and B are incompatible, i.e., do not commute, then, by mea- 
suring A more precisely, we are forced to measure B less precisely, and vice 
versa. We can not simultaneously measure both A and B to to unlimited 
precision. Measurement of A somehow has an impact on the measurement 
oiB. 



^We have assumed units have been chosen such that h = 1. 
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4.11. Young's two slit experiment — An example of Heisenberg's 
uncertainty principle. For the purpose of illustrating Heisenberg's Un- 
certainty Principle, Professor Dirac wheeled out into the classroom a device 
to demonstrate Young's two slit experiment. The device consisted of an 
electron gun which spewed out electron^ in the direction of a wall with 
two slits. The electrons that managed to pass through the two slits then 
impacted on a backstop which consisted of a 1600 x 1200 rectangular lattice 
of extremely small counters. Prom the back of the backstop, all of the 
1,920,000 tiny counters on the backstop were individually connected to a 
PC by a cable consisting of a dense bundle of filaments. 

Professor Dirac pointed to the PC, and explained that the PC was setup 
to display on the CRT's 1600 x 1200 pixel screen the individual running total 
counts of all the backstop counters . He went on to say that the intensity 
P of pixel on the screen was proportional to the total number of 
electrons counted so far by the counter at position in the backstop. 

Professor Dirac proceeded to demonstrate what the device could actually 
do. He turned on the electron gun, and turned down its intensity so low 
that the probability of more than two electrons being emitted at the same 
time was negligibly small. 

His first experiment with the device was to cover slit 2, allowing the 
incoming electrons to pass only through slit 1. He reset all the counters on 
the backstop to zero, and then stepped back to let the students in his class 
view the screen. 

Initially nothing could be seen on the screen but blackness. However, 
gradually an intensity pattern began to form on the screen. At first the 
displayed pattern was indiscernible. But eventually it began to look like the 
intensity pattern of a classical two dimensional Gaussian distribution. He 
then pressed a key on his computer to show a three dimensional plot of the 
intensity P{i,j) as a surface in 3-space. Then with the click of a mouse, 
he displayed a plot of the intensity P along the vertical line j = 800 
going down the center of the screen. The plot was that of the bell shaped 
classical one dimensional Gaussian distribution curve Pi, as shown in Fig. 
3a. This was a clear indication that the random impacts on the backstop 
were obeying the classical Gaussian distribution. 

When he repeated the experiment with the slit 1 instead of slit 2 covered, 
exactly the same pattern of a classical two dimensional Gaussian distribution 
pattern was seen, but only this time shifted vertically down a short distance 
on the screen. A plot of the intensity P{i,j) of along the vertical line 
j = 800 going down the center of the screen is indicated by curve P2 shown 
in Fig. 3a. 



The original Young's two slit experiment used photons rather than electrons. 
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Figure 3a. Young's two slit experiment with one slit closed. 



Professor Dirac then asked the students in the class what pattern they 
thought would appear if he left both of the slits uncovered. Most of the 
class responded by saying that the resulting light pattern would simply be 
the sum of the two patterns, i.e., the bell shaped curve P1+P2, as illustrated 
in Fig. 3c by the curve labeled P{2- Most of the class was convinced that the 
two classical probability distributions would simply add, as many of them 
had learned in the probability course Prob 323. 

The remainder of the class stated quite emphatically that they did not 
care what happened. What was being illustrated was far from an applied 
area, and hence not relevant to their real world. Or so they thought ... 

Professor Dirac smiled, and then proceeded to uncover both slits. What 
appeared on the screen to almost everyone's surprise was not the pattern 
with the bell shape P1+P2. It was instead a light pattern with a wavy bell 
shaped curve, as illustrated by the curve P12 in Fig. 3b. 
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Figure 3b. Young's two slit experiment with both slits open. 

Professor Dirac explained, "Something non-classical had occurred. Un- 
like classical probabilities, the quantum probabilities (or more correctly 
stated, the quantum amplitudes) had interfered with one another to produce 
an interference pattern. In the dark areas, one finds destructive interference. 
In the bright areas, one finds constructive interference." 

"Indeed, something non-classical is happening here." 
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"Strangely enough, quantum mechanics is telhng us that each electron is 
actually passing through both slits simultaneously! It is as if each electron 
were a wave and not a particle." 



"But what happens when we actually try to observe through which slit 
each electron passes?" 

Professor Dirac pulled out his trusty microscop^ to observe which of the 
two slits each electron passed through. He reset all the backstop counters 
to zero, turned on the device, and began observing through which slit each 
electron passed through. The class was much surprised to find that the 
wavey interference pattern did not appear on the screen this time. Instead, 
what appeared was the classical intensity pattern all had initially expected 
to see in the first place, i.e., the intensity pattern of the bell shaped curve 
Pi2 = Pi + P2, as shown in Fig. 3c. 



"So we see that, when observed, the electrons act as particles and not as 
waves!" 



Electron 
Gun 



. , Ught 
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Figure 3c. Young's 2 slit experiment when the slit through which the 
electron passes is determined by observation. 

After a brief pause. Professor Dirac said, "This is actually an example of 
the Heisenberg Uncertainty Principle. We can see this as follows:" 

"In the experiment, we are effectively observing two incompatible observ- 
ables, the position operator X (i.e., which slit each electron passes through) 
and the momentum operator P (i.e., the momentum with which each elec- 
tron leaves the slitted wall.) When we observe the momentum P, the 
interference pattern is present. But when we observe the position X, the 
interference pattern vanishes. We can not observe position without disturb- 
ing momentum, and vice versa." 



5. The Beginnings of Quantum Cryptography 



^This is a most unusual microscope. 
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5.1. Alice has an idea. After class on her way back to her dorm room, 
Alice began once again to ruminate over her dilemma in regard to Bob and 
Eve. 

"If only her message to Bob were like the interference pattern in Young's 
two slit experiment. Then, if the prying Eve were to observe which of the 

two slits each of the electrons emerged from (i.e., 'listen in'), Bob would 
know of her presence. For, if Eve were observing the individual electrons 
as they left the slits, the pattern on the screen would be distorted from 
the beautiful wavy interference pattern in a direction toward the dull ugly 
Gaussian distribution pattern. Bob would see this distortion, and thereby 
be able to surmise that Eve was eavesdropping." 




Wall Backstop R 



Figure 4a. Bob sees an interference pattern when Eve is not eavesdropping. 




Figure 4b. Bob sees no interference pattern when Eve is eavesdropping. 

"This idea has possibilities. Maybe quantum mechanics is relevant after 
all!" 

Her mind began to race. "Perhaps something like Young's two slit ex- 
periment could be used to communicate random key Kl Then Bob could 
tell which key had been compromised by an intruder such as Eve. But most 
importantly, he could also surmise which key had not been compromised. 
Bob could then communicate to me over the phone (or even over any public 
channel available also to Eve) whether or not the key had been compro- 
mised, without, of course, revealing the key itself. Any uncompromised key 
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could then be employed to send Bob a message by using the one-time-pad 
that was mentioned yesterday in Crypto 351." 

"The beauty of this approach is that the one-time-pad is perfectly secure. 
There is no way whatsoever that Eve could get any information about our 
conversation. This would be true even if I used the campus radio station 
to send my encrypted message." 

"The evil Eve is foiled! Eureka! Contrary to student conventional 
wisdom, both cryptography and quantum mechanics are relevant to the real 
world!" 

"I have discovered a new kind of secrecy, i.e., quantum secrecy, which 
has built-in detection of eavesdropping based on the principles of quantum 
mechanics. I can hardly wait to tell Professor Dirac. She ran immediately 
to his office." 

After listening to Alice's excited impromptu, and at times disjointed, 
explanation. Professor Dirac suggested that she present her newly found 
discoveries in his next class. Alice happily agreed to do so. 

5.2. Quantum secrecy — The BB84 protocol without noise. Two 

days later, after two sleepless but productive nights of work, Alice was pre- 
pared for her presentation. She walked in the classroom for Quantum 317 
carrying an overhead projector and a sizable bundle of transparencies. 

After Professor Dirac had turned the large lecture hall over to her, she 
began as follows: 

"Let us suppose that I (Alice) would like to transmit a secret key K to 
Bob. Let us also suppose that someone by the name of Eve intends to make 
every effort to eavesdrop on the transmission and learn the secret key." 

Wouldn't you know it. Eve just so happens to be sitting in the classroom! 

"My objective today is to show you how the principles of quantum me- 
chanics can be used to build a cryptographic communication system in such 
a way that the system detects if Eve is eavesdropping, and which also gives 
a guarantee of no intrusion if Eve is not eavesdropping." 

"A diagrammatic outline of the system I'm about to describe is shown on 
the screen. (Please refer to Fig. 5.) Please note that the system consists 
of two communication channels. One is a non-classical one-way quantum 
communication channel, which I will soon describe. The other is an ordinary 
run-of the-mill classical two-way public channel, such as a two-way radio 
communication system. I emphasize that this classical two-way channel is 
public, and open to whomever would like to listen in. For the time being, 
I will assume that the two-way public channel is noise free." 
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Figure 5. A quantum cryptographic communication system 



"I will now describe how the polarization states of the photon can be used 
to construct a quantum one-way communication channel^." 

"From Professor Dirac's last lecture, we know that the polarization states 
of a photon lie in a two dimensional Hilbert space Ti. For this space, 
there are many orthonormal bases. We will use only two for our quantum 
channel." 



"The first is the basis consisting of the vertical and horizontal polariza- 
tion states, i.e., the kets ||) and |^), respectively. We will refer to this 
orthonormal basis as the vertical/horizontal (V/H) basis, and denote 
this basis with the symbol 'ffl.' " 

"The second orthonormal basis consists of the polarization states \y) 
and |\), which correspond to polarizations directions formed respectively 
by 45% clockwise and counter-clockwise rotations off from the vertical. We 
call this the oblique basis, and denote this basis with the symbol 'Kl.' " 

"If I (Alice) decide to use the VH basis ffl on the quantum channel, then 
I will use the following quantum alphabet: 

•1" = II) 

•0" = 1^) 

In other words, if I use this quantum alphabet on the quantum channel, I 
will transmit a "1" to Bob simply by sending a photon in the polarization 
state II)., and I will transmit a "0" by sending a photon in the polarization 
state |<-^)." 



Any two dimensional quantum system such as a spin i particle could be used. 
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"On the other hand, if I (AHce) decide to use the obhque basis lEl, then I 
will use the following quantum alphabet: 

' "1" = \/) 

< 

_ "0" = |\) 

sending a "1" as a photon in the polarization state and sending a "0" 
as a photon in the polarization state |\)." 

"I have chosen these two bases because the Heisenberg Uncertainty Prin- 
ciple implies that observations with respect to the ffl basis are incompatible 
with observations with respect to the lEI basis. We will soon see how this 
incompatibility can be translated into intrusion detection." 
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Fig. 6a. The BB84 protocol without Eve present (No noise) 

Alice and Bob now communicate with one another using a two stage 
protocol, called the BB84 protocol[?]. (Please refer to Figs. 6a and 6b.) 

In stage 1, Alice creates a random sequence of bits, which she sends to 
Bob over the quantum channel using the following protocol: 

Stage 1 protocol: Communication over a quantum channel 



Step 1. Alice flips a fair coin to generate a random sequence S Alice of zeroes 
and ones. This sequence will be used to construct a secret key shared 
only by Alice and Bob. 

Step 2. For each bit of the random sequence, Alice flips a fair coin again to 
choose at random one of the two quantum alphabets. She then trans- 
mits the bit as a polarized photon according to the chosen alphabet. 
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Step 3. Each time Bob receives a photon sent by Ahce, he has no way of know- 
ing which quantum alphabet was chosen by AUce. So he simply uses 
the flip of a fair coin to select one of the two alphabets and makes his 
measurement accordingly. Half of the time he will be lucky and choose 
the same quantum alphabet as Eve. In this case, the bit resulting from 
his measurement will agree with the bit sent by Alice. However, the 
other half of the time he will be unlucky and choose the alphabet not 
used by Alice. In this case, the bit resulting from his measurement 
will agree with the bit sent by Alice only 50% of the time. After all 
these measurements. Bob now has in hand a binary sequence Ssob- 

Alice and Bob now proceed to communicate over the public two-way chan- 
nel using the following stage 2 protocol: 

Stage 2 protocol: Communication over a public channel 



Phase 1. Raw key extraction 

Step 1. Over the public channel, Bob communicates to Alice which quantum 
alphabet he used for each of his measurements. 

Step 2. In response, Alice communicates to Bob over the public channel which 
of his measurements were made with the correct alphabet. 

Step 3. Alice and Bob then delete all bits for which they used incompatible 
quantum alphabets to produce their resulting raw keys. If Eve has 
not eavesdropped, then their resulting raw keys will be the same. If 
Eve has eavesdropped, their resulting raw keys will not be in total 
agreement. 
Phase 2. Error estimation 

Step 1. Over the public channel, Alice and Bob compare small portions of their 
raw keys to estimate the error-rate i?, and then delete the disclosed 
bits from their raw keys to produce their tentative final keys. If 
through their public disclosures, Alice and Bob find no errors (i.e., 
-R = 0), then they know that Eve was not eavesdropping and that 
their tentative keys must be the same final key. If they discover at 
least one error during their public disclosures (i.e., i? > 0), then they 
know that Eve has been eavesdropping. In this case, they discard 
their tentative final keys and start all over againf^ 



^^If Eve were to intercept each qubit received from Alice, to measure it, and then to 
masqurade as Ahce by sending on to Bob a qubit in the state she measured, then Eve 
would be introducing a 25% error rate in Bob's raw key. This method of eavesdropping 
is called opaque eavesdropping. We will discuss this eavesdropping strategy as well as 
others at a later time. 
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Fig 6b. The BB84 with Eve present (No noise) 

5.3. Quantum secrecy — The BB84 protocol with noise. Alice con- 
tinues her presentation by addressing the issue of noise. 

"So far we have assumed that our cryptographic communication system 
is noise free. But every realistic communication system has noise present. 
Consequently, we now need to modify our quantum protocol to allow for the 
presence of noise." 

"We must assume that Bob's raw key is noisy. Since Bob can not dis- 
tinguish between errors caused by noise and by those caused by Eve's intru- 
sion, the only practical working assumption he can adopt is that all errors 
are caused by Eve's eavesdropping. Under this working assumption. Eve is 
always assumed to have some information about bits transmitted from Alice 
to Bob. Thus, raw key is always only partially secret." 

"What is needed is a method to distill a smaller secret key from a larger 
partially secret key. We call this privacy amplification. We will now 

create from the old protocol a new protocol that allows for the presence of 
noise, a protocol that includes privacy amplification." 

Stage 1 protocol: Communication over a quantum channel 

This stage is exactly the same as before, except that errors are now also 
induced by noise. 

Stage 2 protocol: Communication over a public channel 
Phase 1 protocol: Raw key extraction. 
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This phase is exactly the same as in the noise-free protocol, except that 
Alice and Bob also delete those bit locations at which Bob should have 
received but did not receive a bit. Such "non-receptions" could be caused 
by Eve's intrusion or by dark counts in Bob's detection device. The 
location of dark counts are communicated by Bob to Alice over the public 
channel. 

Phase 2 protocol: Error estimation. 

Over the public channel, Alice and Bob compare small portions of their 
raw keys to estimate the error-rate R, and then delete the disclosed bits from 
their raw key to produce their tentative final keys. If R exceeds a certain 
threshold RMax, then privacy amplification is not possible If so, Alice and 
Bob return to stage 1 to start over. On the other hand, if i? < Rmqx, then 
Alice and Bob proceed to phase 3. 

Phase 3 protocol: Extraction of reconciled keyQ. 

In this phase|^, Alice and Bob remove all errors from what remains of 
raw key to produce a common error-free key, called reconciled key. 

Step 1. Alice and Bob publically agree upon a random permutation, and apply 
it to what remains of their respective raw keys. Next Alice and Bob 
partition the remnant raw key into blocks of length i, where the length 
i is chosen so that blocks of that length are unlikely to have more 
than one error. For each of these blocks, Alice and Bob publically 
compare overall parity checks, making sure each time to discard the 
last bit of each compared block. Each time an overall parity check 
does not agree, Alice and Bob initiate a binary search for the error, 
i.e., bisecting the block into two subblocks, publically comparing the 
parities for each of these subblocks, discarding the right most bit of 
each subblock. They continue their bisective search on the subblock 
for which their parities are not in agreement. This bisective search 
continues until the erroneous bit is located and deleted. They then 
continue to the next £-block. 

This step is repeated, i.e., a random permutation is chosen, a rem- 
nant raw key is partitioned into blocks of length £, parities are com- 
pared, etc.. This is done until it becomes inefficient to continue in this 
fashion. 



^ There are more efficient and elegant procedures than the procedure descibed in Stage 
2 Phase 3. See for references. 

^■^The procedure given in Stage 2 Phase 3 is only one of many different possible pro- 
cedures. In fact, there are much more efficient and elegant procedures than the one 
described herein. 
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Step 2. Alice and Bob publically select randomly chosen subsets of remnant 
raw key, publically compare parities, each time discarding an agreed 
upon bit from their chosen key sample. If a parity should not agree, 
they employ the binary search strategy of Step 1 to locate and delete 
the error. 

• Finally, when, for some fixed number N of consecutive repetitions of 
Step 2, no error is found, Alice and Bob assume that to a high probabil- 
ity, the remnant raw key is without error. Alice and Bob now rename 
the remnant raw key reconciled key, and proceed to the next phase. 

Phase 4: Privacy amplification 

Alice and Bob now have a common reconciled key which they know is 
only partially secret from Eve. They now begin the process of privacy 
amplification, which is the extraction of a secret key from a partially secret 
one. 

Step 1. Alice and Bob compute from the error-rate R obtained in Phase 2 of 
Stage 2 an upper bound k of the number of bits of reconciled key known 
by Eve. 

Let n denote the number of bits in reconciled key, and let s be a security 
parameter to be adjusted as required. 

Step 2. Alice and Bob publically select n — k — s random subsets of reconciled 
key, without revealing their contents. The undisclosed parities of these 
subsets become the final secret key. 
It can be shown that Eve's average information about the final secret key 
is less than 2~*/ln2 bits. 

The bell rang, indicating the end of the period. The entire class with two 
exceptions, immediately raced out of the lecture hall, almost knocking Alice 
down as they passed by. Professor Dirac thanked Alice for an excellent 
presentation. 

As Alice left, she saw Eve in one of the dark recesses of the large lecture 
hall with her head resting on the palm of her hand as if in deep thought. 
She had a frown on her face. Alice left with a broad smile on her face. 

6. The B92 quantum cryptographic protocol 
In the next class, Alice continued her last presentation. 

In thinking about the BB84 protocol this weekend, I was surprised to 
find that it actually is possible to build a different quantum protocol that 
uses only one quantum alphabet instead of two. I'll call this new quantum 
protocol B92." 
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"As before, we will describe the protocol in terms of the polarization 
states of the photon]^." 

"As our quantum alphabet, we choose 

"1" = 16*+) 



"0" = |6'_) 

where and \6^) denote respectively the polarization states of a photon 
linearly polarized at angles 6 and —9 with respect to the vertical, where 
0<6 < f ." 

"We assume that Bob's quantum receiver, called a POVM receiver 
is base on the following observablesp^ 

- 1 + (6»+|e_) 



A 



1 + {e+\e_) 

A, = i-Ae^- Ag_ 

where Aq_^ is the observable for Aq_ the observable for and A? is 
the observables for inconclusive receptions." 

The B92 quantum protocol is as follows: 

Stage 1 protocol. Communication over a quantum channel. 

Step 1. The same as in the BB84 protocol. Alice flips a fair coin to 
generate a random sequence SAUce of zeroes and ones. This sequence will 
be used to construct a secret key shared only by Alice and Bob. 

Step 2. The same as in the previous protocol, except this time Alice uses 
only one alphabet, the one above. So she does not have to flip a coin to 
choose an alphabet. 

Step 3. Bob uses his POVM receiver to measure photons received from 
Alice. 

Stage 2. Communication in four phases over a public channel. 

This stage is the same as in the BB84 protocol, except that in phase 1, 
Bob publically informs Alice as to which time slots he received non-erasures. 
The bits in these time slots become Alice's and Bob's raw keys. 

Alice completed her discussion of the B92 protocol with. 



Any two dimensional quantum system such as a spin i particle could be used. 
The observables Ag_^_ , Ag_ , and A-? form a postive operator value measure (POVM) . 
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"Eve's presence is again detected by an unusual error rate in Bob's raw 
key. Moreover, for some but not all eavesdropping strategies, Eve can also 
be detected by an unusual erasure rate for Bob." 

Alice then stepped down from the lecture hall podium and returned to 
her seat. 

7. There are many other quantum cryptographic protocols 

Before continuing our story about Alice, Bob, and Eve, there are a few 
points that need to be made: 

There are many other quantum cryptographic protocols. Quantum pro- 
tocols showing the greatest promise for security are those based on EPR 
pairs. Unfortunately, the technology for implementing such protocols is not 
yet available. For references on various protocols, please refer to [|l^]. 

8. A comparison of quantum cryptography with classical and 



Quantum cryptography's unique contribution is that it provides a mech- 
anism for eavesdropping detection. This is an entirely new contribution to 
cryptography. On the other hand, one of the main drawbacks of quantum 
cryptography is that it provides no mechanism for authentication, i.e., for 
detecting whether or not Alice and Bob are actually communicating with 
each other, and not with an intermediate Eve masquerading as each of them. 
Thus, the Catch 22 problem is not solved by quantum cryptography. Before 
Alice and Bob can begin their quantum protocol, they first need to send an 
authentication key over a secure channel. 

Thus, quantum cryptography's unique contribution is to provide a means 
of expanding existing secure key. Quantum protocols are secure key ex- 
panders. First a small authentication key is exchanged over a secure 
channel. Then that key can be amplified to an arbitrary length through 
quantum cryptography. 



PUBLIC KEY CRYPTOGRAPHY 



Check List for Q. Crypto. Sys. 



■ Catch 22 Solved? 



YES & NO 



■ Authentication? 



NO 



■ Intrusion Detection? 



YES 
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9. Eavesdropping strategies and counter measures 
Now let us resume our story: 

Not a split second after Alice had seated herself, Eve raised her hand 
and asked for permission to make her own presentation to the class. Pro- 
fessor Dirac yielded the podium, not knowing exactly what to expect, but 
nonetheless elated that his usually phlegmatic class was beginning to show 
signs of something he had not seen for some time, class participation and 
initiative. 

Eve began, "In the last two classes, Alice has suggested that I (Eve) might 
be eager to eavesdrop on her conversations with my 'v'close'v' friend 'v'Bob's?. 
I assure you that that simply is in no way true." 

"But such innuendo really doesn't bother me." 

9.1. Opaque eavesdropping. "What really irks me is that Alice suggests 
that, if I were to eavesdrop (which never would happen), then I (Eve) would 
use opaque eavesdropping. By opaque eavesdropping, I mean that 
I (Eve) would intercept and observe (measure) Alice's photons, and then 
masquerade as Alice by sending photons in the states I had measured on to 
Bob." 

"I assure you that, if I ever wanted to eavesdrop (which will never be the 
case), I would not use such a simplistic form of intrusion." 

Eve really wanted to use the adjective 'stupid' instead of 'simplistic,' but 
restrained herself. 

Eve then said indignantly, "If I ever were to eavesdrop (which would never 
happen), I would use more sophisticated, more intelligent, and yes ... , more 
deliciously devious schemes!" 

9.2. Translucent eavesdropping without entanglement. "I (Eve) could 
for example make my probe interact unitarily with the information carrier 
from Alice, and then let it proceed on to Bob in a slightly modified state. 
For the B92 protocol, the interaction is given by: 

' \e+)\^)^u\e+)\^) = \e'^)\^+) 

< 

\e_)\^p)^u\e.)\iJ) = \e'_)\iJ-) 

where \tp) and \ip±) denote respectively the state of my (Eve's) probe before 
and after the interaction and where \6±) and |^^|_) denote respectively the 
state of Alice's photon before and after the interaction." 
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9.3. Translucent eavesdropping with entanglement. "Another approach, 
one of the most sophisticated, would be for me (EVE) to entangle my probe 
with the information carrier from Alice, and then let it proceed on to Bob. 
For the B92 protocol, the interaction is given by: 

' \e+) IV) ^ u \e+) IV) = a |^v> IV+) + b\eL) |v+) 
^ \e.) IV) ^ u \e.) IV) = b \9'+) IV-) +a\e'_) |V-) 

where |V) and |V±) denote respectively the state of my (Eve's) probe before 
and after the entanglement and where \6±) and \6'^) denote respectively the 
state of Alice's photon before and after the entanglement." 

9.4. Eavesdropping based on implementation w^eaknesses. "On the 
other hand, I could also take advantage of implementation weaknesses." 

"One of the great difficulties with quantum cryptography is that tech- 
nology has not quite caught up with it. Many devices, such as lasers, do 
not emit a single quantum, but many quanta at each emission time. The 
implementation of quantum protocols really requires single-quantum emit- 
ters. Such single-quantum emitters are now under development. Until such 
emitters become available, the quantum protocols can only be approximately 
implemented." 

"For example, for many optical implementations of quantum protocols, 
the laser intensity is turned down so that on the average only one photon is 
produced every 10 pulses. Thus, if anything is emitted at all (one chance out 
of 10), then the probability that it is a single photon is extremely high. How- 
ever, when there is an emission, then there is a probability of that more 
than one photon is emitted. So it is conceivable that I (Eve) could build an 
eavesdropping device that would detect multiple photon transmissions, and, 
when so detected, would divert one of the photons for measurement. In 
this way, I (Eve) could conceivably read ^ of Alice's transmission without 
being detected. One way of countering this type of threat is to allow for it 
during privacy amplification. Another is to develop devices which actually 
truly emit one quanta at a time." 

"Finally, depending on Alice's implementation, it might also be possible 
for me (Eve) to gain information simply by observing Alice's transmitter 
without measuring its output. This may or may not be far fetched." 

Eve then returned to her seat. Her face was lit up with a sinister grin of 
satisfaction. 
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10. Implementations 



Before continuing our story, we should mention that quantum crypto- 
graphic protocols have been implemented over more than 30 kilometers of 
fiber optic cable, |2^,|2l|,|22], |23], and most amazingly, over more than a 




11 



,@, lol in the presence of ambient sun- 



12gB,i2ii 

kilometer of free space 
light. There have been a number of ambitious proposals to demonstrate 
the feasibility of quantum cryptography in earth to satellite communica- 
tions. And as mentioned earlier, there is a clear need for the development 
of single-quantum emitting devices. 



11. Conclusion 



Much remains to be done. There has been some work on the develop- 
ment of multiple-user quantum cryptographic protocols for communication 
networks [p^ . There also have been at least two independent claims of the 
proof of ultimate security, i.e., a proof that quantum cryptographic proto- 
cols are impervious to all possible eavesdropping strategies |l^, [15|, |16], 

[0- 



Our story continues: 



As Alice sat in her seat, she happened to spy in the corner of her eye an 
abrupt change in Eve's demeanor. Eve suddenly became agitated, lit up 
with excitement, and started to frantically write on her notepad. The bell 
rang. Eve immediately jumped up, and raced out of the lecture hall, being 
pushed along by the usual frantic mass of students, equally eager to get out 
of the classroom. 

As Eve whisked past, Alice caught just a fleeting glimpse of Eve's notepad. 
All Alice was able to discern in that brief moment was an illegible jumble 
of equations and ... yes, ... the acronym "POVM." 

Alice thought to herself, "Oh, well! ... Forget it! I think I'll just visit 
Bob this weekend." 



THE ENDq 



^''Any resemblance of the characters in this manuscript to individuals hving or dead is 
purely coincidental. 
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